@tanstack/react-start-rsc

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, which can indicate a monorepo subpackage or a weaker package-to-source link. The matching TanStack organization and substantial repository tree make the monorepo explanation plausible, but the linkage is still less transparent.

Security policycaution

The repository has no security policy. This is a transparency gap for a framework package, though active development and security scanning provide partial compensation.

Workflow auditcaution

All nine workflows were analyzed successfully, all 33 action references are pinned, and no untrusted checkout or script-injection paths were found. Three high-confidence low-severity adhoc-package findings and top-level write permissions in three workflows are minor hygiene concerns without an untrusted trigger.